Overview
There are two basic categories of internal controls – preventive and detective. An effective internal control system will have both types, as each serves a different purpose. As you perform routine processes, or when you are thinking of implementing a new procedure or process, it is important to ask the following questions to help determine the appropriate control:
- What could go wrong?
- What steps have been taken to ensure that something does not go wrong?
- How can you verify that nothing went wrong?
The answers to these questions will enable you to better target the type of control that is needed.
Preventive Controls
Preventive controls aim to decrease the chance of errors and fraud before they occur, and often revolve around the concept of separation of duties. From a quality standpoint, preventive controls are essential because they are proactive and focused on quality.
Examples of preventive controls include:
- Separation of duties
- Pre-approval of actions and transactions (such as a Travel Authorization)
- Access controls (such as passwords and Gatorlink authentication)
- Physical control over assets (i.e. locks on doors or a safe for cash/checks)
- Employee screening and training (such as the PRO3 Series to increase employee knowledge)
Detective Controls
Detective controls are designed to find errors or problems after the transaction has occurred. Detective controls are essential because they provide evidence that preventive controls are operating as intended, as well as offer an after-the-fact chance to detect irregularities.
Examples of detective controls include:
- Monthly reconciliations of departmental transactions
- Review organizational performance (such as a budget-to-actual comparison to look for any unexpected differences)
- Physical inventories (such as a cash or inventory count)
Training
PRO303: Internal Controls at UF
Contacts
University Controller’s Office: (352) 392-1321
Last Reviewed
Last reviewed on 03/20/2024
FAQs
Internal Control Types and Activities
- Preventive controls are proactive in that they attempt to deter or prevent undesirable events from occurring.
- Corrective controls are put in place when errors or irregularities have been detected.
- Detective controls provide evidence that an error or irregularity has occurred.
The seven internal control procedures are separation of duties, access controls, physical audits, standardized documentation, trial balances, periodic reconciliations, and approval authority.
What are the five 5 components of internal control? ›
There are five interrelated components of an internal control framework: control environment, risk assessment, control activities, information and communication, and monitoring.
What are the 3 categories of internal controls based on purpose? ›
The three main types of internal controls are preventative, detective, and corrective controls. 1) Preventative controls: Preventative controls are designed to prevent misstatements from occurring, whether due to fraud or error.
What are the six internal controls? ›
The six principles of control activities are: 1) Establishment of responsibility, 2) Segregation of duties, 3) Documentation procedures, 4) Physical controls, 5) Independent internal verification, 6) Human resource controls.
What are the three types of internal control deficiencies? ›
Internal control deficiencies are problems, misconfigurations, or instances of internal controls going unchecked that can lead to non-compliance, inefficiency, misalignment, and misreporting over time. In essence, internal controls are of three types—preventive, detective, and corrective.
What is basic internal control? ›
Internal control is a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance: That information is reliable, accurate and timely. Of compliance with applicable laws, regulations, contracts, policies and procedures.
What is an example of a good internal control? ›
Examples include security for and limited access to assets such as cash, inventories, and equipment which might be vulnerable to risk of loss or unauthorized use. Such assets should be periodically counted and compared to control records.
How many types of control are there? ›
In modern organizations, there are three kinds of control that you will usually find, Concurrent control. Feedback control. Feedforward control.
What are key controls? ›
Key controls are the primary procedures relied upon to mitigate a risk or prevent fraud. Non-key controls are considered secondary or back up controls. All controls can be grouped into one of the four components of internal control: Control environment. Risk assessment.
A system of internal controls should be informed by an appropriately detailed and periodically performed risk assessment that identifies which critical processes might be susceptible to errors, thereby potentially creating quantitatively and qualitatively significant risks for your company.
How to identify controls? ›
Actual controls can be identified from discussion with the auditee, observation, review of process documentation and risk registers / board assurance framework. Perform a walk-through to confirm controls are in place.
What are the two basic categories of internal controls? ›
Overview. There are two basic categories of internal controls – preventive and detective. An effective internal control system will have both types, as each serves a different purpose.
How to write an internal control? ›
To write effective internal controls, you need to:
- Identify who will be responsible for monitoring in each case.
- Set clear expectations around the internal controls process.
- Communicate clearly regarding how often monitoring should be carried out.
- Document your processes and the internal control measures in place.
The 4 Main Types of Controls in Audits (with Examples) Internal controls (which include manual, IT-dependent manual, IT general, and application controls) are essential process steps that allow for one to determine or confirm whether certain requirements are being done per a certain expectation, law, or policy.
What are four examples of internal control? ›
Examples of Internal Controls
- Segregation of Duties. When work duties are divided or segregated among different people to reduce the risk of error or inappropriate actions.
- Physical Controls. ...
- Reconciliations. ...
- Policies and Procedures. ...
- Transaction and Activity Reviews. ...
- Information Processing Controls.
The primary purpose of internal controls is to help safeguard an organization and further its objectives. Internal controls function to minimize risks and protect assets, ensure accuracy of records, promote operational efficiency, and encourage adherence to policies, rules, regulations, and laws.
